Skip to content

Commit 9e0c1d3

Browse files
biazmoreirabiazmoreira
committed
Add HCP engine token logic
1 parent 6af8bc7 commit 9e0c1d3

File tree

8 files changed

+308
-165
lines changed

8 files changed

+308
-165
lines changed

‎api/client.go

+33-1
Original file line numberDiff line numberDiff line change
@@ -82,6 +82,8 @@ const (
8282
const (
8383
EnvVaultAgentAddress = "VAULT_AGENT_ADDR"
8484
EnvVaultInsecure = "VAULT_SKIP_VERIFY"
85+
86+
DefaultAddress = "https://127.0.0.1:8200"
8587
)
8688

8789
// WrappingLookupFunc is a function that, given an HTTP verb and a path,
@@ -248,7 +250,7 @@ type TLSConfig struct {
248250
// If an error is encountered, the Error field on the returned *Config will be populated with the specific error.
249251
func DefaultConfig() *Config {
250252
config := &Config{
251-
Address: "https://127.0.0.1:8200",
253+
Address: DefaultAddress,
252254
HttpClient: cleanhttp.DefaultPooledClient(),
253255
Timeout: time.Second * 60,
254256
MinRetryWait: time.Millisecond * 1000,
@@ -589,6 +591,7 @@ type Client struct {
589591
requestCallbacks []RequestCallback
590592
responseCallbacks []ResponseCallback
591593
replicationStateStore *replicationStateStore
594+
hcpCookie *http.Cookie
592595
}
593596

594597
// NewClient returns a new client for the given configuration.
@@ -1025,6 +1028,33 @@ func (c *Client) SetToken(v string) {
10251028
c.token = v
10261029
}
10271030

1031+
// HCPCookie returns the cookie being used by this client. It will
1032+
// return an empty cookie no cookie set.
1033+
func (c *Client) HCPCookie() string {
1034+
c.modifyLock.RLock()
1035+
defer c.modifyLock.RUnlock()
1036+
1037+
if c.hcpCookie == nil {
1038+
return ""
1039+
}
1040+
return c.hcpCookie.String()
1041+
}
1042+
1043+
// SetHCPCookie sets the hcp cookie directly. This won't perform any auth
1044+
// verification, it simply sets the token properly for future requests.
1045+
func (c *Client) SetHCPCookie(v *http.Cookie) error {
1046+
c.modifyLock.Lock()
1047+
defer c.modifyLock.Unlock()
1048+
1049+
if err := v.Valid(); err != nil {
1050+
return err
1051+
}
1052+
1053+
c.hcpCookie = v
1054+
1055+
return nil
1056+
}
1057+
10281058
// ClearToken deletes the token if it is set or does nothing otherwise.
10291059
func (c *Client) ClearToken() {
10301060
c.modifyLock.Lock()
@@ -1299,6 +1329,8 @@ func (c *Client) NewRequest(method, requestPath string) *Request {
12991329
Params: make(map[string][]string),
13001330
}
13011331

1332+
req.HCPCookie = c.hcpCookie
1333+
13021334
var lookupPath string
13031335
switch {
13041336
case strings.HasPrefix(requestPath, "/v1/"):

‎api/request.go

+7
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,9 @@ type Request struct {
3939
// EGPs). If set, the override flag will take effect for all policies
4040
// evaluated during the request.
4141
PolicyOverride bool
42+
43+
// HCPCookie is used to set a http cookie when client is connected to HCP
44+
HCPCookie *http.Cookie
4245
}
4346

4447
// SetJSONBody is used to set a request body that is a JSON-encoded value.
@@ -145,5 +148,9 @@ func (r *Request) toRetryableHTTP() (*retryablehttp.Request, error) {
145148
req.Header.Set("X-Vault-Policy-Override", "true")
146149
}
147150

151+
if r.HCPCookie != nil {
152+
req.AddCookie(r.HCPCookie)
153+
}
154+
148155
return req, nil
149156
}

‎command/base.go

+38-1
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ import (
99
"fmt"
1010
"io"
1111
"io/ioutil"
12+
"net/http"
1213
"os"
1314
"regexp"
1415
"strings"
@@ -22,6 +23,8 @@ import (
2223
"github.com/mitchellh/cli"
2324
"github.com/pkg/errors"
2425
"github.com/posener/complete"
26+
27+
hcpvlib "github.com/hashicorp/vault-hcp-lib"
2528
)
2629

2730
const (
@@ -69,7 +72,8 @@ type BaseCommand struct {
6972

7073
flagHeader map[string]string
7174

72-
tokenHelper token.TokenHelper
75+
tokenHelper token.TokenHelper
76+
hcpTokenHelper hcpvlib.HCPTokenHelper
7377

7478
client *api.Client
7579
}
@@ -79,6 +83,10 @@ type BaseCommand struct {
7983
func (c *BaseCommand) Client() (*api.Client, error) {
8084
// Read the test client if present
8185
if c.client != nil {
86+
if err := c.applyHCPConfig(); err != nil {
87+
return nil, err
88+
}
89+
8290
return c.client, nil
8391
}
8492

@@ -195,9 +203,38 @@ func (c *BaseCommand) Client() (*api.Client, error) {
195203

196204
c.client = client
197205

206+
if err := c.applyHCPConfig(); err != nil {
207+
return nil, err
208+
}
209+
198210
return client, nil
199211
}
200212

213+
func (c *BaseCommand) applyHCPConfig() error {
214+
hcpToken, err := c.hcpTokenHelper.GetHCPToken()
215+
if err != nil {
216+
return err
217+
}
218+
219+
if hcpToken != nil {
220+
cookie := &http.Cookie{
221+
Name: "hcp_access_token",
222+
Value: hcpToken.AccessToken,
223+
Expires: hcpToken.AccessTokenExpiry,
224+
}
225+
226+
if err := c.client.SetHCPCookie(cookie); err != nil {
227+
return fmt.Errorf("unable to correctly connect to the HCP Vault cluster; please reconnect to HCP: %w", err)
228+
}
229+
230+
if err := c.client.SetAddress(hcpToken.ProxyAddr); err != nil {
231+
return fmt.Errorf("unable to correctly set the HCP address: %w", err)
232+
}
233+
}
234+
235+
return nil
236+
}
237+
201238
// SetAddress sets the token helper on the command; useful for the demo server and other outside cases.
202239
func (c *BaseCommand) SetAddress(addr string) {
203240
c.flagAddress = addr

‎command/base_test.go

+40
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,12 @@ import (
77
"net/http"
88
"reflect"
99
"testing"
10+
11+
"github.com/hashicorp/vault/api"
12+
"github.com/stretchr/testify/assert"
13+
"github.com/stretchr/testify/require"
14+
15+
hcpvlib "github.com/hashicorp/vault-hcp-lib"
1016
)
1117

1218
func getDefaultCliHeaders(t *testing.T) http.Header {
@@ -70,3 +76,37 @@ func TestClient_FlagHeader(t *testing.T) {
7076
}
7177
}
7278
}
79+
80+
// TestClient_HCPConfiguration tests that the HCP configuration is applied correctly when it exists in cache.
81+
func TestClient_HCPConfiguration(t *testing.T) {
82+
cases := map[string]struct {
83+
Valid bool
84+
ExpectedAddr string
85+
}{
86+
"valid hcp configuration": {
87+
Valid: true,
88+
ExpectedAddr: "https://hcp-proxy.addr:8200",
89+
},
90+
"empty hcp configuration": {
91+
Valid: false,
92+
ExpectedAddr: api.DefaultAddress,
93+
},
94+
}
95+
96+
for n, tst := range cases {
97+
t.Run(n, func(t *testing.T) {
98+
bc := &BaseCommand{hcpTokenHelper: &hcpvlib.TestingHCPTokenHelper{tst.Valid}}
99+
cli, err := bc.Client()
100+
assert.NoError(t, err)
101+
102+
if tst.Valid {
103+
require.Equal(t, tst.ExpectedAddr, cli.Address())
104+
require.NotEmpty(t, cli.HCPCookie())
105+
require.Contains(t, cli.HCPCookie(), "hcp_access_token=Test.Access.Token")
106+
} else {
107+
require.Equal(t, tst.ExpectedAddr, cli.Address())
108+
require.Empty(t, cli.HCPCookie())
109+
}
110+
})
111+
}
112+
}

‎command/commands.go

+15-4
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,8 @@ import (
7171
sr "github.com/hashicorp/vault/serviceregistration"
7272
csr "github.com/hashicorp/vault/serviceregistration/consul"
7373
ksr "github.com/hashicorp/vault/serviceregistration/kubernetes"
74+
75+
hcpvlib "github.com/hashicorp/vault-hcp-lib"
7476
)
7577

7678
const (
@@ -245,10 +247,11 @@ var (
245247
func initCommands(ui, serverCmdUi cli.Ui, runOpts *RunOptions) map[string]cli.CommandFactory {
246248
getBaseCommand := func() *BaseCommand {
247249
return &BaseCommand{
248-
UI: ui,
249-
tokenHelper: runOpts.TokenHelper,
250-
flagAddress: runOpts.Address,
251-
client: runOpts.Client,
250+
UI: ui,
251+
tokenHelper: runOpts.TokenHelper,
252+
flagAddress: runOpts.Address,
253+
client: runOpts.Client,
254+
hcpTokenHelper: &hcpvlib.InternalHCPTokenHelper{},
252255
}
253256
}
254257

@@ -905,9 +908,17 @@ func initCommands(ui, serverCmdUi cli.Ui, runOpts *RunOptions) map[string]cli.Co
905908
}
906909

907910
entInitCommands(ui, serverCmdUi, runOpts, commands)
911+
initHCPCommands(ui, commands)
912+
908913
return commands
909914
}
910915

916+
func initHCPCommands(ui cli.Ui, commands map[string]cli.CommandFactory) {
917+
for cmd, cmdFactory := range hcpvlib.InitHCPCommand(ui) {
918+
commands[cmd] = cmdFactory
919+
}
920+
}
921+
911922
// MakeShutdownCh returns a channel that can be used for shutdown
912923
// notifications for commands. This channel will send a message for every
913924
// SIGINT or SIGTERM received.

‎go.mod

+26-22
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,9 @@ module github.com/hashicorp/vault
1010
// semantic related to Go module handling), this comment should be updated to explain that.
1111
//
1212
// Whenever this value gets updated, sdk/go.mod should be updated to the same value.
13-
go 1.20
13+
go 1.21
14+
15+
toolchain go1.21.3
1416

1517
replace github.com/hashicorp/vault/api => ./api
1618

@@ -41,7 +43,7 @@ require (
4143
github.com/apple/foundationdb/bindings/go v0.0.0-20190411004307-cd5c9d91fad2
4244
github.com/armon/go-metrics v0.4.1
4345
github.com/armon/go-radix v1.0.0
44-
github.com/asaskevich/govalidator v0.0.0-20200907205600-7a23bdc65eef
46+
github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d
4547
github.com/aws/aws-sdk-go v1.44.331
4648
github.com/aws/aws-sdk-go-v2/config v1.18.19
4749
github.com/axiomhq/hyperloglog v0.0.0-20220105174342-98591331716a
@@ -78,7 +80,7 @@ require (
7880
github.com/hashicorp/consul-template v0.33.0
7981
github.com/hashicorp/consul/api v1.23.0
8082
github.com/hashicorp/errwrap v1.1.0
81-
github.com/hashicorp/eventlogger v0.2.5
83+
github.com/hashicorp/eventlogger v0.2.3
8284
github.com/hashicorp/go-bexpr v0.1.12
8385
github.com/hashicorp/go-cleanhttp v0.5.2
8486
github.com/hashicorp/go-discover v0.0.0-20210818145131-c573d69da192
@@ -120,12 +122,13 @@ require (
120122
github.com/hashicorp/hcl/v2 v2.16.2
121123
github.com/hashicorp/hcp-link v0.1.0
122124
github.com/hashicorp/hcp-scada-provider v0.2.1
123-
github.com/hashicorp/hcp-sdk-go v0.23.0
125+
github.com/hashicorp/hcp-sdk-go v0.70.1-0.20231027171745-aa8cd4ca3fa0
124126
github.com/hashicorp/nomad/api v0.0.0-20230519153805-2275a83cbfdf
125127
github.com/hashicorp/raft v1.3.10
126128
github.com/hashicorp/raft-autopilot v0.2.0
127129
github.com/hashicorp/raft-boltdb/v2 v2.0.0-20210421194847-a7e34179d62c
128130
github.com/hashicorp/raft-snapshot v1.0.4
131+
github.com/hashicorp/vault-hcp-lib v0.0.0-20231102155729-bf8c13c2e544
129132
github.com/hashicorp/vault-plugin-auth-alicloud v0.16.0
130133
github.com/hashicorp/vault-plugin-auth-azure v0.16.2
131134
github.com/hashicorp/vault-plugin-auth-centrify v0.15.1
@@ -149,7 +152,7 @@ require (
149152
github.com/hashicorp/vault-plugin-secrets-gcpkms v0.15.1
150153
github.com/hashicorp/vault-plugin-secrets-kubernetes v0.6.0
151154
github.com/hashicorp/vault-plugin-secrets-kv v0.16.2
152-
github.com/hashicorp/vault-plugin-secrets-mongodbatlas v0.10.2
155+
github.com/hashicorp/vault-plugin-secrets-mongodbatlas v0.10.1
153156
github.com/hashicorp/vault-plugin-secrets-openldap v0.11.2
154157
github.com/hashicorp/vault-plugin-secrets-terraform v0.7.3
155158
github.com/hashicorp/vault-testing-stepwise v0.1.4
@@ -212,17 +215,17 @@ require (
212215
go.opentelemetry.io/otel/trace v1.16.0
213216
go.uber.org/atomic v1.11.0
214217
go.uber.org/goleak v1.2.1
215-
golang.org/x/crypto v0.14.0
218+
golang.org/x/crypto v0.13.0
216219
golang.org/x/exp v0.0.0-20230522175609-2e198f4a06a1
217-
golang.org/x/net v0.17.0
218-
golang.org/x/oauth2 v0.11.0
220+
golang.org/x/net v0.15.0
221+
golang.org/x/oauth2 v0.12.0
219222
golang.org/x/sync v0.3.0
220-
golang.org/x/sys v0.13.0
221-
golang.org/x/term v0.13.0
223+
golang.org/x/sys v0.12.0
224+
golang.org/x/term v0.12.0
222225
golang.org/x/text v0.13.0
223-
golang.org/x/tools v0.10.0
226+
golang.org/x/tools v0.9.1
224227
google.golang.org/api v0.138.0
225-
google.golang.org/grpc v1.58.3
228+
google.golang.org/grpc v1.57.0
226229
google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0
227230
google.golang.org/protobuf v1.31.0
228231
gopkg.in/ory-am/dockertest.v3 v3.3.4
@@ -334,8 +337,8 @@ require (
334337
github.com/dvsekhvalnov/jose2go v1.5.0 // indirect
335338
github.com/emicklei/go-restful/v3 v3.10.1 // indirect
336339
github.com/emirpasic/gods v1.18.1 // indirect
337-
github.com/envoyproxy/go-control-plane v0.11.1 // indirect
338-
github.com/envoyproxy/protoc-gen-validate v1.0.2 // indirect
340+
github.com/envoyproxy/go-control-plane v0.11.1-0.20230524094728-9239064ad72f // indirect
341+
github.com/envoyproxy/protoc-gen-validate v0.10.1 // indirect
339342
github.com/evanphx/json-patch/v5 v5.6.0 // indirect
340343
github.com/form3tech-oss/jwt-go v3.2.5+incompatible // indirect
341344
github.com/fsnotify/fsnotify v1.6.0 // indirect
@@ -348,16 +351,16 @@ require (
348351
github.com/go-logr/logr v1.2.4 // indirect
349352
github.com/go-logr/stdr v1.2.2 // indirect
350353
github.com/go-ole/go-ole v1.2.6 // indirect
351-
github.com/go-openapi/analysis v0.20.0 // indirect
352-
github.com/go-openapi/errors v0.20.1 // indirect
354+
github.com/go-openapi/analysis v0.21.4 // indirect
355+
github.com/go-openapi/errors v0.20.3 // indirect
353356
github.com/go-openapi/jsonpointer v0.19.6 // indirect
354357
github.com/go-openapi/jsonreference v0.20.2 // indirect
355-
github.com/go-openapi/loads v0.20.2 // indirect
356-
github.com/go-openapi/runtime v0.19.24 // indirect
357-
github.com/go-openapi/spec v0.20.3 // indirect
358-
github.com/go-openapi/strfmt v0.20.0 // indirect
358+
github.com/go-openapi/loads v0.21.2 // indirect
359+
github.com/go-openapi/runtime v0.25.0 // indirect
360+
github.com/go-openapi/spec v0.20.8 // indirect
361+
github.com/go-openapi/strfmt v0.21.3 // indirect
359362
github.com/go-openapi/swag v0.22.3 // indirect
360-
github.com/go-openapi/validate v0.20.2 // indirect
363+
github.com/go-openapi/validate v0.22.1 // indirect
361364
github.com/go-ozzo/ozzo-validation v3.6.0+incompatible // indirect
362365
github.com/goccy/go-json v0.10.0 // indirect
363366
github.com/godbus/dbus v0.0.0-20190726142602-4481cbc300e2 // indirect
@@ -455,6 +458,7 @@ require (
455458
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
456459
github.com/nicolai86/scaleway-sdk v1.10.2-0.20180628010248-798f60e20bb2 // indirect
457460
github.com/nwaples/rardecode v1.1.2 // indirect
461+
github.com/oklog/ulid v1.3.1 // indirect
458462
github.com/opencontainers/go-digest v1.0.0 // indirect
459463
github.com/opencontainers/image-spec v1.1.0-rc2.0.20221005185240-3a7f492d3f1b // indirect
460464
github.com/opencontainers/runc v1.1.6 // indirect
@@ -469,7 +473,7 @@ require (
469473
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
470474
github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c // indirect
471475
github.com/pquerna/cachecontrol v0.1.0 // indirect
472-
github.com/prometheus/client_model v0.4.0 // indirect
476+
github.com/prometheus/client_model v0.3.0 // indirect
473477
github.com/prometheus/procfs v0.8.0 // indirect
474478
github.com/renier/xmlrpc v0.0.0-20170708154548-ce4a1a486c03 // indirect
475479
github.com/rogpeppe/go-internal v1.10.0 // indirect

0 commit comments

Comments
 (0)